How not to get caught in law-enforcement geofence requests

I thought I'd write up a response to this question from well-known 4th Amendment and CFAA lawyer Orin Kerr:

Question for tech people related to "geofence" warrants served on Google: How easy is it for a cell phone user, either of an Android or an iPhone, to stop Google from generating the detailed location info needed to be responsive to a geofence warrant? What do you need to do?

— Orin Kerr (@OrinKerr) September 15, 2021

(FWIW, I'm seeking info from people who actually know the answer based on their expertise, not from those who are just guessing, or are who are now googling around to figure out what the answer may be,)

— Orin Kerr (@OrinKerr) September 15, 2021

First, let me address the second part of his tweet, whether I'm technically qualified to answer this. I'm not sure, I have only 80% confidence that I am. Hence, I'm writing this answer as blogpost hoping people will correct me if I'm wrong.

There is a simple answer and it's this: just disable "Location" tracking in the settings on the phone. Both iPhone and Android have a one-click button to tap that disables everything.

The trick is knowing which thing to disable. On the iPhone it's called "Location Services". On the Android, it's simply called "Location".

If you do start googling around for answers, you'll find articles upset that Google is still tracking them. That's because they disabled "Location History" and not "Location". This left "Location Services" and "Web and App Activity" still tracking them. Disabling "Location" on the phone disables all these things [*].

It's that simple: one click and done, and Google won't be able to report your location in a geofence request.

I'm pretty confident in this answer, despite what your googling around will tell you about Google's pernicious ways. But I'm only 80% confident in my answer. Technology is complex and constantly changing.

Note that the answer is very different for mobile phone companies, like AT&T or T-Mobile. They have their own ways of knowing about your phone's location independent of whatever Google or Apple do on the phone itself. Because of modern 4G/LTE, cell towers must estimate both your direction and distance from the tower. I've confirmed that they can know your location to within 50 feet. There are limitations to this, it depends upon whether you are simply in range of the tower or have an active phone call in progress. Thus, I think law enforcement prefers asking Google.

Another example is how my car uses Google Maps all the time, and doesn't have privacy settings. I don't know what it reports to Google. So when I rob a bank, my phone won't betray me, but my car will.

Note that "disabling GPS" isn't sufficient. I include the screenshot above because of how it mentions the phone relies upon WiFi, BlueTooth, and cell tower info to also confirm your location. Tricking GPS will do little to stop your phone from knowing your location.

I only know about this from the phone side of things and not actual legal cases. I'd love to see the sort of geofence results the FBI gets. There might be some subtle thing that I missed about how Android works with mobile companies, such as this old story where Android phones reported cell tower information to Google (since removed). Or worse, there might be something completely obvious I should've known about that everyone seems to know, but for some reason I simply forgot.

Both Apple and Google are upfront about what private information they do and don't track and how to disable it. Thus, while I think they may do something on accident hidden from view, I don't think there's anything going on that isn't documented. And what's documented this concern is that simply turning off the "Location" button.

---

Update: Many comments note that Google does log the IP address of requests, and that IP addresses can sometimes be geolocated.

Well, yes and no. It's not something companies log in that way. Thus, when given a geofence request for everything within a certain physical location, logs containing only IP addresses wouldn't be something covered by the request. The log would need a record of the physical location to be covered. Moreover, geolocation by IP address is incredibly inaccurate, often telling you only what city or neighborhood where the IP address is located. Even if Google logged a record of the best-guess about location, I'm still not sure whether it would be an appropriate response to a geofence request.

In any event, this wouldn't apply to mobile IP addresses. In America, consumer mobile phones don't have public IP addresses by share the same pool of private addresses. Thus, the IP address from a mobile phone is meaningless for location purposes.

Now you can create a hypothetical situation like the following:

• a Capitol Hill protestor logs onto a nearby WiFi (meaning: it's not the mobile IP address in question, but the IP address of the WiFi hotspot)
• the geolocation record of that WiFi hotspot is actually accurate
• requests to Google resolves that geolocation when it logs the IP address
• they give such IP/location logs in response to geofence request

Then, yes, my argument is defeated, a hypothetical geofence request might then get you.

Which I actually like. It's a good demonstration of why I doubt myself at the top of the post. I don't think this scenario is likely, and hence don't consider it a reasonable rebuttal, but "unlikely" doesn't mean "impossible". I'm still pretty confident that a one-click disabling "Location" is all you need to defeat geofence warrants given to Google.

Note that the discussion of this blogpost is just about the "geofence request to Google". This "Capital Hill WiFi" hypothetical is unlikely to help with requests by location, but of course would for requests by IP address. Law enforcement could certainly ask Google for a list of users that came in via the Capital Hill WiFi IP address.

Except I bet they started with cell carriers and are being thorough.

Contact Google via public wifi in the Capitol and BOOM.

— Bob (Moderna #3) Kerns (@BobKerns) September 15, 2021